GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Fixes #591

Stacked on #1328 (#558): the hosted half reuses that PR's served-tarball fetch. The base is agent/v5-yarn-classic-sha1, and GitHub retargets this PR to main once #1328 merges.

Summary

A patch that rewrites the patched package's own package.json to add a dependency, or to move one to a new range, no longer leaves a yarn classic lock that yarn can't install reproducibly.

• Vendored: the patch is refused before any wiring is written, as vendor_dep_manifest_unlocked, when a dependency descriptor (name@range) has no yarn.lock block of its own. The staged uuid dir is removed. When every descriptor is already locked, the sub-maps are recomputed as before.
• Hosted: for any classic entry it hasn't pinned yet, the scan reads the served tarball's package.json (one download per artifact, checked against the grant's sha512, shared with Hosted yarn classic rewrite drops the #sha1 fragment when the grant has no sha1, so yarn's cache serves stale bytes: yarn ≤1.17 silently installs the unpatched package, and yarn ≥1.19 fails every warm-cache install #558's sha1 derivation).
  • If a descriptor isn't locked, the pin is refused (redirect_yarn_classic_dep_manifest_unlocked). The uuid is never confirmed or attested, and the lock is left alone.
  • If every descriptor is already locked, the block's dependencies: / optionalDependencies: sub-maps are rewritten to match (redirect_yarn_classic_dep_manifest_rewritten).
• Both refusals name the descriptors and give a remedy: lock them first (for example yarn add is-odd@^3.0.0), then re-run.

Root cause

• Vendored rewrite_classic_block (vendor/yarn_classic_lock.rs) recomputed the sub-map from the patched manifest but never checked that each descriptor resolves to a block. The result was a dangling dependency: online frozen installs fetched it unpinned, --offline installs failed, and every plain yarn install re-saved the lock.
• Hosted rewrite_yarn_classic never saw the patched manifest, so yarn kept the old graph. An added dependency was never installed, and a changed range stayed at the old version, while scan and vex reported success.

Changes

• formats/yarn/classic_deps.rs is new. It holds the sub-map rebuild (moved from the vendored backend), unlocked_descriptors and dep_maps_match, shared by both writers.
• NpmLockBackend::manifest_refusal is a new hook, checked after staging and before wire. The yarn classic backend implements it.
• Hosted, disk and in-memory flows: yarn_classic_artifact_targets / fetch_hosted_classic_artifact / fetch_classic_artifacts return the sha1 plus the manifest. The manifest is passed to the classic rewriter through the existing per-URL metadata map, the one the berry bin: renderer uses.
  • A fetch is made only for a registry block of the package that isn't pinned yet, or when the grant lacks a sha1.
  • No fetch is made when an offline mirror refuses the lock outright.
• Docs: CLI_CONTRACT.md (yarn classic row of the vendor table, plus three code rows) and docs/ecosystems.md (yarn classic hosted notes).

Tests (red before, green after)

• vendor::yarn_classic_lock::tests::issue_591_added_dependency_without_a_lock_block_is_refused
• vendor::yarn_classic_lock::tests::issue_591_changed_range_without_a_lock_block_is_refused, which also checks that the patch vendors once the new range is locked.
• Both vendored tests ran red with the refusal hook disabled: vendoring returned Done.
• patch::redirect::tests::issue_591_hosted_classic_checks_the_served_manifest_against_the_lock covers an added dep, a changed range, an unchanged manifest, and a locked new range whose sub-map is rewritten.
• scan::hosted_yarn_classic_sha1::issue_591_served_dependency_the_lock_does_not_lock_is_refused (built binary + wiremock) ran red on the Hosted yarn classic rewrite drops the #sha1 fragment when the grant has no sha1, so yarn's cache serves stale bytes: yarn ≤1.17 silently installs the unpatched package, and yarn ≥1.19 fails every warm-cache install #558 base: it pinned and reported redirected: 1.
• formats::yarn::classic_deps::tests::*

Fixture updates

The hosted classic pin now reads the served tarball, so these mocks serve a real tarball whose grant hashes match it:

• covgap_commands_scan_hosted (2 classic tests), in_process_redirect (CRLF classic test), hosted_memory_parity (parity_yarn_classic, via a serve_npm_tarballs case option), and e2e_redirect_yarn_classic_build::mock_hosted_grant.
• In classic_redirect_tampered_hosted_tarball_fails_integrity, the scan's own read now gets the real bytes and yarn's install gets the tampered ones. Without that, the scan would refuse the tampered bytes before yarn's integrity check ever ran.
• Existing vendored sub-map tests now lock the descriptors their patches add.

Commands run

• cargo test --workspace --all-features --no-fail-fast: green except the e2e_vendor_cargo_build old-toolchain legs (x86_64 rustup 1.41 can't exec on this arm64 host). After the rebase onto the Fix fragmentless yarn classic hosted pins (#558) #1328 review fix, I re-ran socket-patch-core --lib and the 9 affected CLI binaries, including the real-yarn e2e_redirect_yarn_classic_build and e2e_vendor_yarn_classic_*, all green.
• cargo clippy --workspace --all-features -- -D warnings: clean.
• cargo fmt --all -- --check: only a pre-existing diff in an untouched file.

Not covered

• vendor --check / repair still pass a lock that an older release already vendored with a dangling descriptor (the Yarn classic: a patch that adds a dependency to the package's own package.json leaves vendored yarn.lock with a dangling dependency (offline frozen install fails, lock churns), and hosted silently installs without it #591 follow-up comment). This PR only stops new runs from writing one.
• A vendored --dry-run stages nothing, so it doesn't foresee vendor_dep_manifest_unlocked.

🤖 Generated with Claude Code